@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/workload-roles/handler.js

@@ -0,0 +1,130 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FIXED_WORKLOAD_ROLE_PROVISIONER_RESULT_SCHEMA_VERSION = void 0;
+exports.createFixedWorkloadRoleProvisionerHandler = createFixedWorkloadRoleProvisionerHandler;
+const provisioner_js_1 = require("./provisioner.js");
+const registration_js_1 = require("./registration.js");
+exports.FIXED_WORKLOAD_ROLE_PROVISIONER_RESULT_SCHEMA_VERSION = 2;
+const failureClassifications = new Set([
+    'aws-iam-create-collision',
+    'aws-iam-nat-profile-substitution',
+    'aws-iam-observation-invalid',
+    'aws-iam-state-race',
+    'boundary-identity-invalid',
+    'boundary-policy-incomplete',
+    'boundary-substitution',
+    'effective-policy-incomplete',
+    'effective-policy-invalid',
+    'effective-policy-substitution',
+    'injection-kind-mismatch',
+    'observed-role-ambiguous',
+    'observed-role-substitution',
+    'provisioned-registration-invalid',
+    'provisioner-boundary-substitution',
+    'provisioner-history-required',
+    'provisioner-observation-incomplete',
+    'provisioner-result-substitution',
+    'registered-manifest-invalid',
+    'registered-manifest-substitution',
+    'registered-request-invalid',
+    'registered-request-substitution',
+    'registration-substitution',
+    'request-substitution',
+    'role-history-invalid',
+    'role-history-reuse',
+    'role-history-substitution',
+    'role-registration-ambiguous',
+    'role-registration-incomplete',
+    'role-registration-substitution',
+]);
+function sanitizedRegistration(registration) {
+    return {
+        registration: {
+            candidateIdentity: registration.candidateIdentity,
+            manifestDigest: registration.manifestDigest,
+            provisionerFunctionArn: registration.provisionerFunctionArn,
+            roles: registration.roles.map((role) => ({
+                boundaryArn: role.boundaryArn,
+                id: role.id,
+                ownership: { ...role.ownership },
+                passDestinations: [...role.passDestinations],
+                permissionPolicyDigest: role.permissionPolicyDigest,
+                roleArn: role.roleArn,
+                roleName: role.roleName,
+                surface: role.surface,
+                trustClass: role.trustClass,
+            })),
+            stage: registration.stage,
+        },
+        schemaVersion: registration_js_1.PROVISIONED_WORKLOAD_ROLE_REGISTRATION_SCHEMA_VERSION,
+    };
+}
+function operationCounts(operationKinds) {
+    return {
+        create: operationKinds.filter((kind) => kind === 'create').length,
+        remove: operationKinds.filter((kind) => kind === 'remove').length,
+        update: operationKinds.filter((kind) => kind === 'update').length,
+    };
+}
+function failureClassification(error) {
+    if (typeof error === 'object' &&
+        error !== null &&
+        'classification' in error &&
+        typeof error.classification === 'string' &&
+        failureClassifications.has(error.classification)) {
+        return error.classification;
+    }
+    return 'fixed-provisioner-internal-error';
+}
+/**
+ * Creates the fixed Lambda handler. Its registered-manifest source and IAM
+ * adapter are closed over at construction; the event cannot select either.
+ * Failures return only a bounded classification and never an exception
+ * message, stack, policy, trust document, authorization, or observed IAM body.
+ */
+function createFixedWorkloadRoleProvisionerHandler(options) {
+    return async (request) => {
+        try {
+            const loaded = await (0, registration_js_1.loadFixedWorkloadRoleProvisionerRequest)({
+                request,
+                source: options.source,
+            });
+            const result = await (0, provisioner_js_1.executeFixedWorkloadRoleProvisioner)({
+                adapter: options.adapter,
+                boundary: loaded.boundary,
+                history: await options.state.loadHistory(),
+                intentsByRole: loaded.document.intentsByRole,
+                manifest: loaded.document.manifest,
+                provisionerFunctionArn: loaded.document.provisionerFunctionArn,
+                registration: loaded.registration,
+                request: loaded.request,
+            });
+            const provisionedRegistration = result.registration
+                ? sanitizedRegistration(result.registration)
+                : undefined;
+            await options.state.saveHistory(result.history);
+            await options.state.saveProvisionedRegistration(provisionedRegistration);
+            return {
+                candidateIdentity: loaded.document.manifest.candidate.identity,
+                historyDigest: result.historyDigest,
+                manifestDigest: result.manifestDigest,
+                ok: true,
+                operation: loaded.request.operation,
+                operationCounts: operationCounts(result.operationKinds),
+                protocolVersion: result.protocolVersion,
+                ...(provisionedRegistration ? { provisionedRegistration } : {}),
+                resultSchemaVersion: exports.FIXED_WORKLOAD_ROLE_PROVISIONER_RESULT_SCHEMA_VERSION,
+                stage: loaded.document.manifest.candidate.stage,
+            };
+        }
+        catch (error) {
+            return {
+                classification: failureClassification(error),
+                ok: false,
+                protocolVersion: provisioner_js_1.FIXED_WORKLOAD_ROLE_PROVISIONER_PROTOCOL_VERSION,
+                resultSchemaVersion: exports.FIXED_WORKLOAD_ROLE_PROVISIONER_RESULT_SCHEMA_VERSION,
+            };
+        }
+    };
+}
+//# sourceMappingURL=handler.js.map

package/src/workload-roles/handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.js","sourceRoot":"","sources":["../../../../../packages/nx/src/workload-roles/handler.ts"],"names":[],"mappings":";;;AAwIA,8FAiDC;AAvLD,qDAI0B;AAC1B,uDAK2B;AAEd,QAAA,qDAAqD,GAAG,CAAU,CAAC;AAEhF,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,0BAA0B;IAC1B,kCAAkC;IAClC,6BAA6B;IAC7B,oBAAoB;IACpB,2BAA2B;IAC3B,4BAA4B;IAC5B,uBAAuB;IACvB,6BAA6B;IAC7B,0BAA0B;IAC1B,+BAA+B;IAC/B,yBAAyB;IACzB,yBAAyB;IACzB,4BAA4B;IAC5B,kCAAkC;IAClC,mCAAmC;IACnC,8BAA8B;IAC9B,oCAAoC;IACpC,iCAAiC;IACjC,6BAA6B;IAC7B,kCAAkC;IAClC,4BAA4B;IAC5B,iCAAiC;IACjC,2BAA2B;IAC3B,sBAAsB;IACtB,sBAAsB;IACtB,oBAAoB;IACpB,2BAA2B;IAC3B,6BAA6B;IAC7B,8BAA8B;IAC9B,gCAAgC;CACjC,CAAC,CAAC;AAqCH,SAAS,qBAAqB,CAC5B,YAAiD;IAEjD,OAAO;QACL,YAAY,EAAE;YACZ,iBAAiB,EAAE,YAAY,CAAC,iBAAiB;YACjD,cAAc,EAAE,YAAY,CAAC,cAAc;YAC3C,sBAAsB,EAAE,YAAY,CAAC,sBAAsB;YAC3D,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBACvC,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,SAAS,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE;gBAChC,gBAAgB,EAAE,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC;gBAC5C,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;gBACnD,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,CAAC,CAAC;YACH,KAAK,EAAE,YAAY,CAAC,KAAK;SAC1B;QACD,aAAa,EAAE,uEAAqD;KACrE,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,cAAiC;IACxD,OAAO;QACL,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,MAAM;QACjE,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,MAAM;QACjE,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,MAAM;KAClE,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,gBAAgB,IAAI,KAAK;QACzB,OAAO,KAAK,CAAC,cAAc,KAAK,QAAQ;QACxC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,EAChD,CAAC;QACD,OAAO,KAAK,CAAC,cAAc,CAAC;IAC9B,CAAC;IACD,OAAO,kCAAkC,CAAC;AAC5C,CAAC;AAED;;;;;GAKG;AACH,SAAgB,yCAAyC,CAAC,OAIzD;IACC,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAA,yDAAuC,EAAC;gBAC3D,OAAO;gBACP,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAA,oDAAmC,EAAC;gBACvD,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,OAAO,EAAE,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE;gBAC1C,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,aAAa;gBAC5C,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ;gBAClC,sBAAsB,EAAE,MAAM,CAAC,QAAQ,CAAC,sBAAsB;gBAC9D,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC,CAAC;YACH,MAAM,uBAAuB,GAAG,MAAM,CAAC,YAAY;gBACjD,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,YAAY,CAAC;gBAC5C,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAChD,MAAM,OAAO,CAAC,KAAK,CAAC,2BAA2B,CAAC,uBAAuB,CAAC,CAAC;YACzE,OAAO;gBACL,iBAAiB,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ;gBAC9D,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,EAAE,EAAE,IAAI;gBACR,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;gBACnC,eAAe,EAAE,eAAe,CAAC,MAAM,CAAC,cAAc,CAAC;gBACvD,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/D,mBAAmB,EACjB,6DAAqD;gBACvD,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK;aAChD,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,cAAc,EAAE,qBAAqB,CAAC,KAAK,CAAC;gBAC5C,EAAE,EAAE,KAAK;gBACT,eAAe,EAAE,iEAAgD;gBACjE,mBAAmB,EACjB,6DAAqD;aACxD,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/src/workload-roles/history.d.ts

@@ -0,0 +1,47 @@
+import { type WorkloadRoleDeclaration, type WorkloadRoleManifest } from './manifest.js';
+export declare const WORKLOAD_ROLE_HISTORY_REVISION: 2;
+export interface HistoricalWorkloadRole {
+    boundaryArn: string;
+    firstCandidateIdentity: string;
+    id: string;
+    lastCandidateIdentity: string;
+    ownership: WorkloadRoleDeclaration['ownership'];
+    passDestinations: string[];
+    permissionPolicyDigest: string;
+    roleName: string;
+    surface: WorkloadRoleDeclaration['surface'];
+    trustClass: WorkloadRoleDeclaration['trustClass'];
+}
+export interface WorkloadRoleTombstone extends HistoricalWorkloadRole {
+    retiredByCandidateIdentity: string;
+    retiredFromManifestDigest: string;
+}
+export interface WorkloadRoleHistory {
+    active: HistoricalWorkloadRole[];
+    currentCandidateIdentity: string;
+    currentManifestDigest: string;
+    historyDigest: string;
+    revision: typeof WORKLOAD_ROLE_HISTORY_REVISION;
+    stage: string;
+    tombstones: WorkloadRoleTombstone[];
+}
+type WorkloadRoleHistoryMaterial = Omit<WorkloadRoleHistory, 'historyDigest'>;
+export type WorkloadRoleHistoryFailureClassification = 'role-history-invalid' | 'role-history-reuse' | 'role-history-substitution';
+export declare class WorkloadRoleHistoryContractError extends Error {
+    readonly classification: WorkloadRoleHistoryFailureClassification;
+    constructor(classification: WorkloadRoleHistoryFailureClassification, message: string);
+}
+/**
+ * Digests the complete canonical history, including every active identity and
+ * tombstone. Callers can review this independently from the active manifest
+ * digest before granting cross-candidate retirement authority.
+ */
+export declare function digestWorkloadRoleHistory(value: WorkloadRoleHistory | WorkloadRoleHistoryMaterial): string;
+export declare function requireWorkloadRoleHistory(value: unknown): WorkloadRoleHistory;
+export declare function workloadRoleManifestFromHistory(value: unknown): WorkloadRoleManifest;
+export declare function advanceWorkloadRoleHistory(options: {
+    manifest: unknown;
+    previous?: unknown;
+}): WorkloadRoleHistory;
+export declare function pendingWorkloadRoleRetirements(history: unknown): WorkloadRoleTombstone[];
+export {};

package/src/workload-roles/history.js

@@ -0,0 +1,324 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WorkloadRoleHistoryContractError = exports.WORKLOAD_ROLE_HISTORY_REVISION = void 0;
+exports.digestWorkloadRoleHistory = digestWorkloadRoleHistory;
+exports.requireWorkloadRoleHistory = requireWorkloadRoleHistory;
+exports.workloadRoleManifestFromHistory = workloadRoleManifestFromHistory;
+exports.advanceWorkloadRoleHistory = advanceWorkloadRoleHistory;
+exports.pendingWorkloadRoleRetirements = pendingWorkloadRoleRetirements;
+const node_crypto_1 = require("node:crypto");
+const manifest_js_1 = require("./manifest.js");
+exports.WORKLOAD_ROLE_HISTORY_REVISION = 2;
+class WorkloadRoleHistoryContractError extends Error {
+    classification;
+    constructor(classification, message) {
+        super(message);
+        this.classification = classification;
+        this.name = 'WorkloadRoleHistoryContractError';
+    }
+}
+exports.WorkloadRoleHistoryContractError = WorkloadRoleHistoryContractError;
+function compareStrings(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+function historicalRole(declaration, firstCandidateIdentity, lastCandidateIdentity) {
+    return {
+        boundaryArn: declaration.boundaryArn,
+        firstCandidateIdentity,
+        id: declaration.id,
+        lastCandidateIdentity,
+        ownership: { ...declaration.ownership },
+        passDestinations: [...declaration.passDestinations],
+        permissionPolicyDigest: declaration.permissionPolicyDigest,
+        roleName: declaration.roleName,
+        surface: declaration.surface,
+        trustClass: declaration.trustClass,
+    };
+}
+function canonicalHistoryMaterial(history) {
+    return {
+        active: history.active
+            .map((role) => ({
+            ...role,
+            ownership: { ...role.ownership },
+            passDestinations: [...role.passDestinations],
+        }))
+            .sort((left, right) => compareStrings(left.id, right.id)),
+        currentCandidateIdentity: history.currentCandidateIdentity,
+        currentManifestDigest: history.currentManifestDigest,
+        revision: exports.WORKLOAD_ROLE_HISTORY_REVISION,
+        stage: history.stage,
+        tombstones: history.tombstones
+            .map((role) => ({
+            ...role,
+            ownership: { ...role.ownership },
+            passDestinations: [...role.passDestinations],
+        }))
+            .sort((left, right) => compareStrings(`${left.roleName}:${left.retiredByCandidateIdentity}`, `${right.roleName}:${right.retiredByCandidateIdentity}`)),
+    };
+}
+function digestHistoryMaterial(history) {
+    return (0, node_crypto_1.createHash)('sha256')
+        .update(JSON.stringify(canonicalHistoryMaterial(history)), 'utf8')
+        .digest('hex');
+}
+function canonicalHistory(history) {
+    const material = canonicalHistoryMaterial(history);
+    return { ...material, historyDigest: digestWorkloadRoleHistory(material) };
+}
+/**
+ * Digests the complete canonical history, including every active identity and
+ * tombstone. Callers can review this independently from the active manifest
+ * digest before granting cross-candidate retirement authority.
+ */
+function digestWorkloadRoleHistory(value) {
+    const { historyDigest: _claimedDigest, ...material } = value;
+    return digestHistoryMaterial(material);
+}
+const candidatePattern = /^[a-z0-9][a-z0-9._-]{0,127}$/;
+const digestPattern = /^[a-f0-9]{64}$/;
+function invalidHistory(message) {
+    throw new WorkloadRoleHistoryContractError('role-history-invalid', message);
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function rejectUnexpected(value, allowed, label) {
+    const unexpected = Object.keys(value).filter((property) => !allowed.includes(property));
+    if (unexpected.length > 0) {
+        invalidHistory(`${label} contains unsupported properties: ${unexpected.sort(compareStrings).join(', ')}.`);
+    }
+}
+function requireCandidate(value, label) {
+    if (typeof value !== 'string' || !candidatePattern.test(value)) {
+        invalidHistory(`${label} is not a normalized candidate identity.`);
+    }
+    return value;
+}
+function requireDigest(value, label) {
+    if (typeof value !== 'string' || !digestPattern.test(value)) {
+        invalidHistory(`${label} is not a lowercase SHA-256 digest.`);
+    }
+    return value;
+}
+const historicalRoleProperties = [
+    'boundaryArn',
+    'firstCandidateIdentity',
+    'id',
+    'lastCandidateIdentity',
+    'ownership',
+    'passDestinations',
+    'permissionPolicyDigest',
+    'roleName',
+    'surface',
+    'trustClass',
+];
+function requireHistoricalRole(value, options) {
+    if (!isRecord(value)) {
+        invalidHistory(`${options.label} must be an object.`);
+    }
+    rejectUnexpected(value, historicalRoleProperties, options.label);
+    const firstCandidateIdentity = requireCandidate(value.firstCandidateIdentity, `${options.label}.firstCandidateIdentity`);
+    const lastCandidateIdentity = requireCandidate(value.lastCandidateIdentity, `${options.label}.lastCandidateIdentity`);
+    if (lastCandidateIdentity !== options.currentCandidateIdentity) {
+        invalidHistory(`${options.label}.lastCandidateIdentity does not match the current candidate.`);
+    }
+    let declaration;
+    try {
+        declaration = (0, manifest_js_1.canonicalizeWorkloadRoleManifest)({
+            candidate: {
+                identity: options.currentCandidateIdentity,
+                stage: options.stage,
+            },
+            roles: [
+                {
+                    boundaryArn: value.boundaryArn,
+                    id: value.id,
+                    ownership: value.ownership,
+                    passDestinations: value.passDestinations,
+                    permissionPolicyDigest: value.permissionPolicyDigest,
+                    roleName: value.roleName,
+                    surface: value.surface,
+                    trustClass: value.trustClass,
+                },
+            ],
+            schemaVersion: 1,
+        }).roles[0];
+    }
+    catch {
+        invalidHistory(`${options.label} is not a valid workload-role identity.`);
+    }
+    if (!declaration) {
+        invalidHistory(`${options.label} is absent.`);
+    }
+    return historicalRole(declaration, firstCandidateIdentity, lastCandidateIdentity);
+}
+function requireTombstone(value, options) {
+    if (!isRecord(value)) {
+        invalidHistory(`${options.label} must be an object.`);
+    }
+    rejectUnexpected(value, [
+        ...historicalRoleProperties,
+        'retiredByCandidateIdentity',
+        'retiredFromManifestDigest',
+    ], options.label);
+    const lastCandidateIdentity = requireCandidate(value.lastCandidateIdentity, `${options.label}.lastCandidateIdentity`);
+    const role = requireHistoricalRole(Object.fromEntries(Object.entries(value).filter(([property]) => historicalRoleProperties.includes(property))), {
+        currentCandidateIdentity: lastCandidateIdentity,
+        label: options.label,
+        stage: options.stage,
+    });
+    return {
+        ...role,
+        retiredByCandidateIdentity: requireCandidate(value.retiredByCandidateIdentity, `${options.label}.retiredByCandidateIdentity`),
+        retiredFromManifestDigest: requireDigest(value.retiredFromManifestDigest, `${options.label}.retiredFromManifestDigest`),
+    };
+}
+function manifestFromHistory(history) {
+    return (0, manifest_js_1.canonicalizeWorkloadRoleManifest)({
+        candidate: {
+            identity: history.currentCandidateIdentity,
+            stage: history.stage,
+        },
+        roles: history.active.map((role) => ({
+            boundaryArn: role.boundaryArn,
+            id: role.id,
+            ownership: role.ownership,
+            passDestinations: role.passDestinations,
+            permissionPolicyDigest: role.permissionPolicyDigest,
+            roleName: role.roleName,
+            surface: role.surface,
+            trustClass: role.trustClass,
+        })),
+        schemaVersion: 1,
+    });
+}
+function requireWorkloadRoleHistory(value) {
+    if (!isRecord(value)) {
+        invalidHistory('Prior workload-role history must be an object.');
+    }
+    rejectUnexpected(value, [
+        'active',
+        'currentCandidateIdentity',
+        'currentManifestDigest',
+        'historyDigest',
+        'revision',
+        'stage',
+        'tombstones',
+    ], 'Prior workload-role history');
+    if (value.revision !== exports.WORKLOAD_ROLE_HISTORY_REVISION ||
+        !Array.isArray(value.active) ||
+        value.active.length === 0 ||
+        !Array.isArray(value.tombstones)) {
+        invalidHistory('Prior workload-role history is malformed or incomplete.');
+    }
+    const currentCandidateIdentity = requireCandidate(value.currentCandidateIdentity, 'Prior workload-role history currentCandidateIdentity');
+    const stage = requireCandidate(value.stage, 'Prior workload-role history stage');
+    const currentManifestDigest = requireDigest(value.currentManifestDigest, 'Prior workload-role history currentManifestDigest');
+    const claimedHistoryDigest = requireDigest(value.historyDigest, 'Prior workload-role history historyDigest');
+    const history = canonicalHistory({
+        active: value.active.map((role, index) => requireHistoricalRole(role, {
+            currentCandidateIdentity,
+            label: `Prior workload-role history active[${index}]`,
+            stage,
+        })),
+        currentCandidateIdentity,
+        currentManifestDigest,
+        revision: exports.WORKLOAD_ROLE_HISTORY_REVISION,
+        stage,
+        tombstones: value.tombstones.map((role, index) => requireTombstone(role, {
+            label: `Prior workload-role history tombstones[${index}]`,
+            stage,
+        })),
+    });
+    const roleNames = [
+        ...history.active.map(({ roleName }) => roleName.toLowerCase()),
+        ...history.tombstones.map(({ roleName }) => roleName.toLowerCase()),
+    ];
+    if (new Set(roleNames).size !== roleNames.length) {
+        invalidHistory('Prior workload-role history contains duplicate active or tombstoned role names.');
+    }
+    let reconstructed;
+    try {
+        reconstructed = manifestFromHistory(history);
+    }
+    catch {
+        invalidHistory('Prior workload-role history does not reconstruct one exact manifest.');
+    }
+    if ((0, manifest_js_1.digestWorkloadRoleManifest)(reconstructed) !== currentManifestDigest) {
+        invalidHistory('Prior workload-role history digest does not match its reconstructed manifest.');
+    }
+    if (history.historyDigest !== claimedHistoryDigest) {
+        invalidHistory('Prior workload-role history digest does not match its complete active and tombstone history.');
+    }
+    return history;
+}
+function workloadRoleManifestFromHistory(value) {
+    return manifestFromHistory(requireWorkloadRoleHistory(value));
+}
+function advanceWorkloadRoleHistory(options) {
+    const manifest = (0, manifest_js_1.canonicalizeWorkloadRoleManifest)(options.manifest);
+    const manifestDigest = (0, manifest_js_1.digestWorkloadRoleManifest)(manifest);
+    if (!options.previous) {
+        return canonicalHistory({
+            active: manifest.roles.map((role) => historicalRole(role, manifest.candidate.identity, manifest.candidate.identity)),
+            currentCandidateIdentity: manifest.candidate.identity,
+            currentManifestDigest: manifestDigest,
+            revision: exports.WORKLOAD_ROLE_HISTORY_REVISION,
+            stage: manifest.candidate.stage,
+            tombstones: [],
+        });
+    }
+    const previous = requireWorkloadRoleHistory(options.previous);
+    if (previous.stage !== manifest.candidate.stage) {
+        throw new WorkloadRoleHistoryContractError('role-history-substitution', 'Workload-role history cannot move between stages.');
+    }
+    const tombstonedNames = new Set(previous.tombstones.map(({ roleName }) => roleName.toLowerCase()));
+    const reused = manifest.roles.filter(({ roleName }) => tombstonedNames.has(roleName.toLowerCase()));
+    if (reused.length > 0) {
+        throw new WorkloadRoleHistoryContractError('role-history-reuse', `Tombstoned role names cannot be reused: ${reused.map(({ roleName }) => roleName).join(', ')}.`);
+    }
+    const previousById = new Map(previous.active.map((role) => [role.id, role]));
+    const nextById = new Map(manifest.roles.map((role) => [role.id, role]));
+    const previousByName = new Map(previous.active.map((role) => [role.roleName.toLowerCase(), role]));
+    const reassigned = manifest.roles.filter((role) => {
+        const prior = previousByName.get(role.roleName.toLowerCase());
+        return prior !== undefined && prior.id !== role.id;
+    });
+    if (reassigned.length > 0) {
+        throw new WorkloadRoleHistoryContractError('role-history-reuse', `Active role names cannot be reassigned to another identity: ${reassigned.map(({ roleName }) => roleName).join(', ')}.`);
+    }
+    const retired = [];
+    for (const prior of previous.active) {
+        const next = nextById.get(prior.id);
+        if (!next || next.roleName !== prior.roleName) {
+            retired.push({
+                ...prior,
+                ownership: { ...prior.ownership },
+                retiredByCandidateIdentity: manifest.candidate.identity,
+                retiredFromManifestDigest: previous.currentManifestDigest,
+            });
+        }
+    }
+    const active = manifest.roles.map((role) => {
+        const prior = previousById.get(role.id);
+        const sameIdentity = prior?.roleName === role.roleName;
+        return historicalRole(role, sameIdentity ? prior.firstCandidateIdentity : manifest.candidate.identity, manifest.candidate.identity);
+    });
+    return canonicalHistory({
+        active,
+        currentCandidateIdentity: manifest.candidate.identity,
+        currentManifestDigest: manifestDigest,
+        revision: exports.WORKLOAD_ROLE_HISTORY_REVISION,
+        stage: manifest.candidate.stage,
+        tombstones: [...previous.tombstones, ...retired],
+    });
+}
+function pendingWorkloadRoleRetirements(history) {
+    return requireWorkloadRoleHistory(history).tombstones.map((entry) => ({
+        ...entry,
+        ownership: { ...entry.ownership },
+        passDestinations: [...entry.passDestinations],
+    }));
+}
+//# sourceMappingURL=history.js.map

package/src/workload-roles/history.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"history.js","sourceRoot":"","sources":["../../../../../packages/nx/src/workload-roles/history.ts"],"names":[],"mappings":";;;AA6HA,8DAMC;AA0LD,gEA0FC;AAED,0EAIC;AAED,gEAwFC;AAED,wEAQC;AAjgBD,6CAAyC;AAEzC,+CAKuB;AAEV,QAAA,8BAA8B,GAAG,CAAU,CAAC;AAmCzD,MAAa,gCAAiC,SAAQ,KAAK;IAE9C;IADX,YACW,cAAwD,EACjE,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,mBAAc,GAAd,cAAc,CAA0C;QAIjE,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;IACjD,CAAC;CACF;AARD,4EAQC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,KAAa;IACjD,OAAO,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,cAAc,CACrB,WAAoC,EACpC,sBAA8B,EAC9B,qBAA6B;IAE7B,OAAO;QACL,WAAW,EAAE,WAAW,CAAC,WAAW;QACpC,sBAAsB;QACtB,EAAE,EAAE,WAAW,CAAC,EAAE;QAClB,qBAAqB;QACrB,SAAS,EAAE,EAAE,GAAG,WAAW,CAAC,SAAS,EAAE;QACvC,gBAAgB,EAAE,CAAC,GAAG,WAAW,CAAC,gBAAgB,CAAC;QACnD,sBAAsB,EAAE,WAAW,CAAC,sBAAsB;QAC1D,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,OAAO,EAAE,WAAW,CAAC,OAAO;QAC5B,UAAU,EAAE,WAAW,CAAC,UAAU;KACnC,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,OAAoC;IAEpC,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;aACnB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACd,GAAG,IAAI;YACP,SAAS,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE;YAChC,gBAAgB,EAAE,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC;SAC7C,CAAC,CAAC;aACF,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3D,wBAAwB,EAAE,OAAO,CAAC,wBAAwB;QAC1D,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,QAAQ,EAAE,sCAA8B;QACxC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,UAAU,EAAE,OAAO,CAAC,UAAU;aAC3B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACd,GAAG,IAAI;YACP,SAAS,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE;YAChC,gBAAgB,EAAE,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC;SAC7C,CAAC,CAAC;aACF,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACpB,cAAc,CACZ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,0BAA0B,EAAE,EACrD,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,0BAA0B,EAAE,CACxD,CACF;KACJ,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,OAAoC;IACjE,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC;SACjE,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,gBAAgB,CACvB,OAAoC;IAEpC,MAAM,QAAQ,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;IACnD,OAAO,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,yBAAyB,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED;;;;GAIG;AACH,SAAgB,yBAAyB,CACvC,KAAwD;IAExD,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,GAAG,QAAQ,EAAE,GAClD,KAA4B,CAAC;IAC/B,OAAO,qBAAqB,CAAC,QAAQ,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,gBAAgB,GAAG,8BAA8B,CAAC;AACxD,MAAM,aAAa,GAAG,gBAAgB,CAAC;AAEvC,SAAS,cAAc,CAAC,OAAe;IACrC,MAAM,IAAI,gCAAgC,CAAC,sBAAsB,EAAE,OAAO,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,gBAAgB,CACvB,KAA8B,EAC9B,OAA0B,EAC1B,KAAa;IAEb,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAC1C,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAC1C,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,cAAc,CACZ,GAAG,KAAK,qCAAqC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC3F,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAE,KAAa;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/D,cAAc,CAAC,GAAG,KAAK,0CAA0C,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,KAAa;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,cAAc,CAAC,GAAG,KAAK,qCAAqC,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,wBAAwB,GAAG;IAC/B,aAAa;IACb,wBAAwB;IACxB,IAAI;IACJ,uBAAuB;IACvB,WAAW;IACX,kBAAkB;IAClB,wBAAwB;IACxB,UAAU;IACV,SAAS;IACT,YAAY;CACJ,CAAC;AAEX,SAAS,qBAAqB,CAC5B,KAAc,EACd,OAIC;IAED,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,cAAc,CAAC,GAAG,OAAO,CAAC,KAAK,qBAAqB,CAAC,CAAC;IACxD,CAAC;IACD,gBAAgB,CAAC,KAAK,EAAE,wBAAwB,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACjE,MAAM,sBAAsB,GAAG,gBAAgB,CAC7C,KAAK,CAAC,sBAAsB,EAC5B,GAAG,OAAO,CAAC,KAAK,yBAAyB,CAC1C,CAAC;IACF,MAAM,qBAAqB,GAAG,gBAAgB,CAC5C,KAAK,CAAC,qBAAqB,EAC3B,GAAG,OAAO,CAAC,KAAK,wBAAwB,CACzC,CAAC;IACF,IAAI,qBAAqB,KAAK,OAAO,CAAC,wBAAwB,EAAE,CAAC;QAC/D,cAAc,CACZ,GAAG,OAAO,CAAC,KAAK,8DAA8D,CAC/E,CAAC;IACJ,CAAC;IACD,IAAI,WAAgD,CAAC;IACrD,IAAI,CAAC;QACH,WAAW,GAAG,IAAA,8CAAgC,EAAC;YAC7C,SAAS,EAAE;gBACT,QAAQ,EAAE,OAAO,CAAC,wBAAwB;gBAC1C,KAAK,EAAE,OAAO,CAAC,KAAK;aACrB;YACD,KAAK,EAAE;gBACL;oBACE,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,EAAE,EAAE,KAAK,CAAC,EAAE;oBACZ,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;oBACxC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;oBACpD,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,UAAU,EAAE,KAAK,CAAC,UAAU;iBAC7B;aACF;YACD,aAAa,EAAE,CAAC;SACjB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,cAAc,CAAC,GAAG,OAAO,CAAC,KAAK,yCAAyC,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,cAAc,CAAC,GAAG,OAAO,CAAC,KAAK,aAAa,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,cAAc,CACnB,WAAW,EACX,sBAAsB,EACtB,qBAAqB,CACtB,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAc,EACd,OAGC;IAED,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,cAAc,CAAC,GAAG,OAAO,CAAC,KAAK,qBAAqB,CAAC,CAAC;IACxD,CAAC;IACD,gBAAgB,CACd,KAAK,EACL;QACE,GAAG,wBAAwB;QAC3B,4BAA4B;QAC5B,2BAA2B;KAC5B,EACD,OAAO,CAAC,KAAK,CACd,CAAC;IACF,MAAM,qBAAqB,GAAG,gBAAgB,CAC5C,KAAK,CAAC,qBAAqB,EAC3B,GAAG,OAAO,CAAC,KAAK,wBAAwB,CACzC,CAAC;IACF,MAAM,IAAI,GAAG,qBAAqB,CAChC,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,CAC1C,wBAAwB,CAAC,QAAQ,CAC/B,QAAqD,CACtD,CACF,CACF,EACD;QACE,wBAAwB,EAAE,qBAAqB;QAC/C,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CACF,CAAC;IACF,OAAO;QACL,GAAG,IAAI;QACP,0BAA0B,EAAE,gBAAgB,CAC1C,KAAK,CAAC,0BAA0B,EAChC,GAAG,OAAO,CAAC,KAAK,6BAA6B,CAC9C;QACD,yBAAyB,EAAE,aAAa,CACtC,KAAK,CAAC,yBAAyB,EAC/B,GAAG,OAAO,CAAC,KAAK,4BAA4B,CAC7C;KACF,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAA4B;IAE5B,OAAO,IAAA,8CAAgC,EAAC;QACtC,SAAS,EAAE;YACT,QAAQ,EAAE,OAAO,CAAC,wBAAwB;YAC1C,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB;QACD,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACnC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;YACnD,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;QACH,aAAa,EAAE,CAAC;KACjB,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,0BAA0B,CACxC,KAAc;IAEd,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,cAAc,CAAC,gDAAgD,CAAC,CAAC;IACnE,CAAC;IACD,gBAAgB,CACd,KAAK,EACL;QACE,QAAQ;QACR,0BAA0B;QAC1B,uBAAuB;QACvB,eAAe;QACf,UAAU;QACV,OAAO;QACP,YAAY;KACb,EACD,6BAA6B,CAC9B,CAAC;IACF,IACE,KAAK,CAAC,QAAQ,KAAK,sCAA8B;QACjD,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;QAC5B,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QACzB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,EAChC,CAAC;QACD,cAAc,CAAC,yDAAyD,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,wBAAwB,GAAG,gBAAgB,CAC/C,KAAK,CAAC,wBAAwB,EAC9B,sDAAsD,CACvD,CAAC;IACF,MAAM,KAAK,GAAG,gBAAgB,CAC5B,KAAK,CAAC,KAAK,EACX,mCAAmC,CACpC,CAAC;IACF,MAAM,qBAAqB,GAAG,aAAa,CACzC,KAAK,CAAC,qBAAqB,EAC3B,mDAAmD,CACpD,CAAC;IACF,MAAM,oBAAoB,GAAG,aAAa,CACxC,KAAK,CAAC,aAAa,EACnB,2CAA2C,CAC5C,CAAC;IACF,MAAM,OAAO,GAAG,gBAAgB,CAAC;QAC/B,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACvC,qBAAqB,CAAC,IAAI,EAAE;YAC1B,wBAAwB;YACxB,KAAK,EAAE,sCAAsC,KAAK,GAAG;YACrD,KAAK;SACN,CAAC,CACH;QACD,wBAAwB;QACxB,qBAAqB;QACrB,QAAQ,EAAE,sCAA8B;QACxC,KAAK;QACL,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC/C,gBAAgB,CAAC,IAAI,EAAE;YACrB,KAAK,EAAE,0CAA0C,KAAK,GAAG;YACzD,KAAK;SACN,CAAC,CACH;KACF,CAAC,CAAC;IACH,MAAM,SAAS,GAAG;QAChB,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC/D,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;KACpE,CAAC;IACF,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM,EAAE,CAAC;QACjD,cAAc,CACZ,iFAAiF,CAClF,CAAC;IACJ,CAAC;IACD,IAAI,aAAmC,CAAC;IACxC,IAAI,CAAC;QACH,aAAa,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,cAAc,CACZ,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,IAAI,IAAA,wCAA0B,EAAC,aAAa,CAAC,KAAK,qBAAqB,EAAE,CAAC;QACxE,cAAc,CACZ,+EAA+E,CAChF,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,aAAa,KAAK,oBAAoB,EAAE,CAAC;QACnD,cAAc,CACZ,8FAA8F,CAC/F,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAgB,+BAA+B,CAC7C,KAAc;IAEd,OAAO,mBAAmB,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,SAAgB,0BAA0B,CAAC,OAG1C;IACC,MAAM,QAAQ,GAAG,IAAA,8CAAgC,EAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpE,MAAM,cAAc,GAAG,IAAA,wCAA0B,EAAC,QAAQ,CAAC,CAAC;IAC5D,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACtB,OAAO,gBAAgB,CAAC;YACtB,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAClC,cAAc,CACZ,IAAI,EACJ,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAC3B,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAC5B,CACF;YACD,wBAAwB,EAAE,QAAQ,CAAC,SAAS,CAAC,QAAQ;YACrD,qBAAqB,EAAE,cAAc;YACrC,QAAQ,EAAE,sCAA8B;YACxC,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,KAAK;YAC/B,UAAU,EAAE,EAAE;SACf,CAAC,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAG,0BAA0B,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9D,IAAI,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QAChD,MAAM,IAAI,gCAAgC,CACxC,2BAA2B,EAC3B,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GAAG,IAAI,GAAG,CAC7B,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAClE,CAAC;IACF,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CACpD,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAC5C,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,gCAAgC,CACxC,oBAAoB,EACpB,2CAA2C,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAChG,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACxE,MAAM,cAAc,GAAG,IAAI,GAAG,CAC5B,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC,CACnE,CAAC;IACF,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QAChD,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QAC9D,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;IACrD,CAAC,CAAC,CAAC;IACH,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,gCAAgC,CACxC,oBAAoB,EACpB,+DAA+D,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACxH,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC9C,OAAO,CAAC,IAAI,CAAC;gBACX,GAAG,KAAK;gBACR,SAAS,EAAE,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE;gBACjC,0BAA0B,EAAE,QAAQ,CAAC,SAAS,CAAC,QAAQ;gBACvD,yBAAyB,EAAE,QAAQ,CAAC,qBAAqB;aAC1D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACzC,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxC,MAAM,YAAY,GAAG,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAAC;QACvD,OAAO,cAAc,CACnB,IAAI,EACJ,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,EACzE,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAC5B,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,OAAO,gBAAgB,CAAC;QACtB,MAAM;QACN,wBAAwB,EAAE,QAAQ,CAAC,SAAS,CAAC,QAAQ;QACrD,qBAAqB,EAAE,cAAc;QACrC,QAAQ,EAAE,sCAA8B;QACxC,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,KAAK;QAC/B,UAAU,EAAE,CAAC,GAAG,QAAQ,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC;KACjD,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,8BAA8B,CAC5C,OAAgB;IAEhB,OAAO,0BAA0B,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACpE,GAAG,KAAK;QACR,SAAS,EAAE,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE;QACjC,gBAAgB,EAAE,CAAC,GAAG,KAAK,CAAC,gBAAgB,CAAC;KAC9C,CAAC,CAAC,CAAC;AACN,CAAC"}

package/src/workload-roles/index.d.ts

@@ -0,0 +1,17 @@
+export * from './aws-adapter.js';
+export * from './aws-internal-handler.js';
+export * from './aws-s3-state.js';
+export * from './aws-sdk-control-plane.js';
+export * from './account-baseline.js';
+export * from './authority.js';
+export * from './boundary.js';
+export * from './convergence.js';
+export * from './effective-policy.js';
+export * from './handler.js';
+export * from './history.js';
+export * from './injection.js';
+export * from './manifest.js';
+export * from './provisioner.js';
+export * from './registration.js';
+export * from './standard-slice.js';
+export * from './stage-boundary.js';

package/src/workload-roles/index.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+tslib_1.__exportStar(require("./aws-adapter.js"), exports);
+tslib_1.__exportStar(require("./aws-internal-handler.js"), exports);
+tslib_1.__exportStar(require("./aws-s3-state.js"), exports);
+tslib_1.__exportStar(require("./aws-sdk-control-plane.js"), exports);
+tslib_1.__exportStar(require("./account-baseline.js"), exports);
+tslib_1.__exportStar(require("./authority.js"), exports);
+tslib_1.__exportStar(require("./boundary.js"), exports);
+tslib_1.__exportStar(require("./convergence.js"), exports);
+tslib_1.__exportStar(require("./effective-policy.js"), exports);
+tslib_1.__exportStar(require("./handler.js"), exports);
+tslib_1.__exportStar(require("./history.js"), exports);
+tslib_1.__exportStar(require("./injection.js"), exports);
+tslib_1.__exportStar(require("./manifest.js"), exports);
+tslib_1.__exportStar(require("./provisioner.js"), exports);
+tslib_1.__exportStar(require("./registration.js"), exports);
+tslib_1.__exportStar(require("./standard-slice.js"), exports);
+tslib_1.__exportStar(require("./stage-boundary.js"), exports);
+//# sourceMappingURL=index.js.map

package/src/workload-roles/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/nx/src/workload-roles/index.ts"],"names":[],"mappings":";;;AAAA,2DAAiC;AACjC,oEAA0C;AAC1C,4DAAkC;AAClC,qEAA2C;AAC3C,gEAAsC;AACtC,yDAA+B;AAC/B,wDAA8B;AAC9B,2DAAiC;AACjC,gEAAsC;AACtC,uDAA6B;AAC7B,uDAA6B;AAC7B,yDAA+B;AAC/B,wDAA8B;AAC9B,2DAAiC;AACjC,4DAAkC;AAClC,8DAAoC;AACpC,8DAAoC"}